{"id":46189,"date":"2022-04-14T14:13:00","date_gmt":"2022-04-14T14:13:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/us-security-agencies-warn-of-threats-to-industrial-utility-control-networks\/"},"modified":"2022-04-14T14:13:00","modified_gmt":"2022-04-14T14:13:00","slug":"us-security-agencies-warn-of-threats-to-industrial-utility-control-networks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/us-security-agencies-warn-of-threats-to-industrial-utility-control-networks\/","title":{"rendered":"US security agencies warn of threats to industrial, utility control networks"},"content":{"rendered":"
<\/div>\n

Key US government security organizations are warning that industrial control system (ICS)\/supervisory control and data acquisition (SCADA)-based networks are being threatened by bad actors armed with custom software tools.<\/p>\n

The Department of Energy (DOE), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and Federal Bureau of Investigation (FBI) issued a joint warning<\/a> that certain advanced persistent threat (APT) actors have shown the ability to gain full system access to compromised ICS\/SCADA systems.<\/p>\n

The alert did not identify which groups were making the threats, but it did recognize Dragos, Mandiant, Microsoft, Palo Alto Networks and Schneider Electric for helping put together the warning. Dragos has posted a paper about part of the threat.<\/p>\n

ICS and SCADA systems typically manage and control large industrial systems and utility networks such as power grids, gas pipelines and water supplies.<\/p>\n

The custom tools referred to in the warning enable attack groups to scan for, compromise, and control affected devices once they have established initial access to the operational technology (OT) network, CISA stated.<\/p>\n

\u201cAdditionally, the actors can compromise Windows-based engineering workstations, which may be present in information technology (IT) or OT environments, using an exploit that compromises an ASRock motherboard<\/a> driver with known vulnerabilities,\u201d CISA stated.<\/p>\n